Overview

overview

10

Static

static

1

BNO1X_bins.sh

ubuntu-18.04-amd64

10

BNO1X_bins.sh

debian-9-armhf

10

BNO1X_bins.sh

debian-9-mips

10

BNO1X_bins.sh

debian-9-mipsel

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    BNO1X_bins.sh

  • Size

    10KB

  • Sample

    241201-a4a4nsvqfm

  • MD5

    29ec86d77f7675942f8a1012ba9709e4

  • SHA1

    062170abb27a237f8468cd5d69fd32f736fc96fe

  • SHA256

    b0ce3fe8b6465a2323009d188a1d3081ce5a76ae93bf4a2809b9aae99ee2205a

  • SHA512

    e28daec2232ae26a0a3a74cee182927727360e36d90970457ae70679a88e74489ffd9532af8c5293b96b8e9999b5fec788508aa0ec69762a22bd7373068e7636

  • SSDEEP

    192:1Iackckcuc9cBUY/u/xXfgbckckcuc9cBwEnH/T:1Ia/nv0wFW/xXfgb/nv0wfH/T

Score
10/10
xorbotantivmbotnetdefense_evasiondiscoveryexecutionlinuxpersistenceprivilege_escalatiotrojan

Malware Config

Targets

    • Target

      BNO1X_bins.sh

    • Size

      10KB

    • MD5

      29ec86d77f7675942f8a1012ba9709e4

    • SHA1

      062170abb27a237f8468cd5d69fd32f736fc96fe

    • SHA256

      b0ce3fe8b6465a2323009d188a1d3081ce5a76ae93bf4a2809b9aae99ee2205a

    • SHA512

      e28daec2232ae26a0a3a74cee182927727360e36d90970457ae70679a88e74489ffd9532af8c5293b96b8e9999b5fec788508aa0ec69762a22bd7373068e7636

    • SSDEEP

      192:1Iackckcuc9cBUY/u/xXfgbckckcuc9cBwEnH/T:1Ia/nv0wFW/xXfgb/nv0wfH/T

    Score
    10/10
    xorbotbotnetdefense_evasiondiscoveryexecutionpersistenceprivilege_escalatiotrojanantivm

    • Detects Xorbot

      botnettrojan

    • Xorbot

      Xorbot is a linux botnet and trojan targeting IoT devices.

      botnettrojanxorbot

    • Xorbot family

      xorbot

    • Creates a large amount of network flows

      This may indicate a network scan to discover remotely running services.

      discovery

    • Contacts a large (1978) amount of remote hosts

      This may indicate a network scan to discover remotely running services.

      discovery

    • File and Directory Permissions Modification

      Adversaries may modify file or directory permissions to evade defenses.

      defense_evasion

    • Executes dropped EXE

    • Renames itself

    • Creates/modifies Cron job

      Cron allows running tasks on a schedule, and is commonly used for malware persistence.

      executionpersistenceprivilege_escalatio

    • Enumerates running processes

      Discovers information about currently running processes on the system

    behavioral1behavioral2behavioral3behavioral4

MITRE ATT&CK Enterprise v15

Tasks